< Previous standard      ^ Up a level ^      Next standard >

ISO/IEC TR 27109 — Information security, cybersecurity and privacy protection — Cybersecurity education and training [DRAFT]

Abstract

[TBA]

Introduction

It appears the standard intends to address the claimed dire global shortage of ‘cyber’ security professionals, hopefully increasing the supply of newly-minted professionals to the market by suggesting standard curricula for educators offering college and university courses etc.

Scope of the standard

[TBA]

Content of the standard

The standard may:

• Cover cybersecurity awareness (?), training and education;
• Suggest common/standard education and training curricula in this area;
• List/mention applicable national guidance, strategies or regulations.

Status

A Technical Report is in preparation.

It was originally to be published in 2024 but the project was extended to 2026 for ‘additional technical work’.

It appears to be languishing at Approved Work Item stage, as of May 2025, and seems unlikely to be published before 2027, if at all.

Personal comments

It would be good if this - or indeed any ISO27k standard clarified the meaning of ‘cyber’ in order to educate those using the term.

The standard will hopefully complement rather than replace ISO/IEC 27021 concerning competencies required of ISMS professionals.

If national guidelines are to be listed, the details will need to be collated and managed indefinitely, implying a stream of maintenance updates to keep the standard reasonably accurate and current. Why is such an approach even being considered? Most other international standards don’t attempt to list national aspects except perhaps as examples.

< Previous standard      ^ Up a level ^      Next standard >